@pagopa/io-react-native-wallet 3.4.4 → 3.5.1

package/src/credential/status/README.md

@@ -31,8 +31,10 @@ graph TD;
   1[verifyAndParseStatusAssertion]
   2[getStatusList]
   3[verifyAndParseStatusList]
+  4[getStatus]
   0 --> 1
   2 --> 3
+  3 --> 4
 ```
 
 ## Mapped results
@@ -104,24 +106,24 @@ const credentialIssuerUrl = "https://issuer.example.com";
 
 const { issuerConf } = await wallet.CredentialIssuance.evaluateIssuerTrust(credentialIssuerUrl);
 
-// Get the status list
-const res = await wallet.CredentialStatus.statusList.get(
-  credential,
-  format,
+// Get the status list token and credential reference index
+const { statusList: statusListJwt, idx } =
+  await wallet.CredentialStatus.statusList.get(credential, format);
+
+// Verify and parse the status list token
+const statusList = await wallet.CredentialStatus.statusList.verifyAndParse(
+  issuerConf.keys,
+  statusListJwt,
 );
 
-// Verify and parse the status list response to get the credential status
-const { status, statusBit } =
-  await wallet.CredentialStatus.statusList.verifyAndParse(
-    issuerConf.keys,
-    res
-  );
+// Read the credential status from the decoded status list
+const { status, rawStatus } = wallet.CredentialStatus.statusList.getStatus(statusList, idx);
 
 return {
-  statusList: res.statusList,
+  statusList,
   status,
-  statusBit,
+  rawStatus,
 };
 ```
 
-</details>
+</details>

package/src/credential/status/api/index.ts

@@ -12,7 +12,9 @@ interface UnsupportedApi {
  *
  * @example
  * if (CredentialStatus.statusList.isSupported) {
- *   const statusList = await CredentialStatus.statusList.get(credential, format)
+ *   const { statusList: statusListJwt, idx } = await CredentialStatus.statusList.get(credential, format)
+ *   const statusList = await CredentialStatus.statusList.verifyAndParse(keys, statusListJwt)
+ *   const status = CredentialStatus.statusList.getStatus(statusList, idx)
  * }
  */
 export interface CredentialStatusApi {

package/src/credential/status/api/status-assertion.ts

@@ -38,7 +38,7 @@ export interface StatusAssertionApi {
    * - The assertion is correctly signed;
    * - It's bound to the given key.
    * @since 1.0.0
-   * @deprecated since 1.3.3 - Use `statusList.verifyAndParse`
+   * @deprecated since 1.3.3 - Use `statusList.get`, `statusList.verifyAndParse` and `statusList.getStatus`
    *
    * @param issuerConf The Issuer configuration returned by `evaluateIssuerTrust`
    * @param statusAssertion The encoded status assertion returned by `statusAssertion.get`

package/src/credential/status/api/status-list.ts

@@ -1,12 +1,12 @@
-import type { Out } from "../../../utils/misc";
 import type { CredentialFormat } from "../../../credential/issuance/api";
 import type { JWK } from "../../../utils/jwk";
+import type { StatusList } from "./types";
 
 export interface StatusListApi {
   isSupported: true;
 
   /**
-   * Get the status list from the credential. This function fetches the list
+   * Get the status list token referenced by a credential. This function fetches the list
    * from the uri found in the credential's `status` claim.
    * @example
    * {
@@ -21,7 +21,7 @@ export interface StatusListApi {
    * @param credential The credential to get the status list for
    * @param format The credential format
    * @param context.appFetch Optional fetch function to use for the network request
-   * @returns The raw status list, the index of the credential and other metadata
+   * @returns The encoded status list token with its credential reference metadata
    */
   get(
     credential: string,
@@ -37,17 +37,40 @@ export interface StatusListApi {
   }>;
 
   /**
-   * Verifies the signature of a status list and extract the status at the specified index.
+   * Get a status list token from its uri.
+   * @since 1.3.3
+   * @param uri The status list uri
+   * @param context.appFetch Optional fetch function to use for the network request
+   * @returns The encoded status list token
+   */
+  getByUri(
+    uri: string,
+    context?: {
+      appFetch?: GlobalFetch["fetch"];
+    }
+  ): Promise<string>;
+
+  /**
+   * Verifies the signature of a status list token and parses its payload.
    * @since 1.3.3
    * @param keys The JSON Web Key Set to verify the status list signature
-   * @param statusListParams The raw status list, the index to read and other metadata
-   * @return The status of the credential and the raw status bit in hexadecimal format (e.g. "0x01")
+   * @param statusList The encoded status list token
+   * @returns The decoded status list payload
    */
-  verifyAndParse(
-    keys: JWK[],
-    statusListParams: Out<StatusListApi["get"]>
-  ): Promise<{
-    statusBit: string;
+  verifyAndParse(keys: JWK[], statusList: string): Promise<StatusList>;
+
+  /**
+   * Extracts the status at the specified index from a decoded status list.
+   * @since 1.3.3
+   * @param statusList The decoded status list
+   * @param idx The index to read
+   * @return The status of the credential and the raw status in hexadecimal format (e.g. "0x01")
+   */
+  getStatus(
+    statusList: StatusList["status_list"],
+    idx: number
+  ): {
+    rawStatus: string;
     status: string;
-  }>;
+  };
 }

package/src/credential/status/api/types.ts

@@ -1,3 +1,6 @@
+import { z } from "zod";
+import { UnixTime } from "../../../utils/zod";
+
 /**
  * Common type for a parsed Status Assertion
  */
@@ -13,3 +16,27 @@ export type ParsedStatusAssertion = {
     description: string;
   };
 };
+
+const StatusListBits = z.union([
+  z.literal(1),
+  z.literal(2),
+  z.literal(4),
+  z.literal(8),
+]);
+
+export type StatusListContent = z.infer<typeof StatusListContent>;
+export const StatusListContent = z.object({
+  bits: StatusListBits,
+  lst: z.string().min(1),
+  aggregation_uri: z.url().optional(),
+});
+
+export type StatusList = z.infer<typeof StatusList>;
+export const StatusList = z.object({
+  sub: z.url(),
+  iat: UnixTime,
+  iss: z.url().optional(),
+  exp: UnixTime.optional(),
+  ttl: z.number().positive().optional(),
+  status_list: StatusListContent,
+});

package/src/credential/status/v1.3.3/01-status-list.ts

@@ -32,25 +32,26 @@ const getStatusListEntry = async (
   return statusListEntry;
 };
 
-export const getStatusList: StatusListApi["get"] = async (
-  credential,
-  format,
+const fetchStatusList = (
+  uri: string,
+  appFetch: GlobalFetch["fetch"],
+  options: { cacheDisabled?: boolean } = {}
+) =>
+  appFetch(uri, {
+    headers: {
+      Accept: "application/statuslist+jwt",
+      ...(options.cacheDisabled && { "Cache-Control": "no-cache" }),
+    },
+  })
+    .then(hasStatusOrThrow(200))
+    .then((response) => response.text());
+
+export const getStatusListByUri: StatusListApi["getByUri"] = async (
+  uri,
   { appFetch = fetch } = {}
 ) => {
-  const { uri, idx } = await getStatusListEntry(credential, format);
-
-  const fetchStatusList = (options: { cacheDisabled?: boolean } = {}) =>
-    appFetch(uri, {
-      headers: {
-        Accept: "application/statuslist+jwt",
-        ...(options.cacheDisabled && { "Cache-Control": "no-cache" }),
-      },
-    })
-      .then(hasStatusOrThrow(200))
-      .then((response) => response.text());
-
   // When the HTTP response includes cache headers, fetch will return a cached response and the JWT might be expired
-  let statusList = await fetchStatusList();
+  let statusList = await fetchStatusList(uri, appFetch);
   const decoded = decodeJwt(statusList);
 
   const { exp } = decoded.payload;
@@ -58,7 +59,18 @@ export const getStatusList: StatusListApi["get"] = async (
   // If the status list JWT is expired, try to fetch it again bypassing the HTTP cache.
   // If it is still expired after the refetch, `verifyAndParseStatusList` will throw.
   if (exp && exp < Math.floor(Date.now() / 1000)) {
-    statusList = await fetchStatusList({ cacheDisabled: true });
+    statusList = await fetchStatusList(uri, appFetch, { cacheDisabled: true });
   }
-  return { statusList, uri, idx, format: "jwt" };
+
+  return statusList;
+};
+
+export const getStatusList: StatusListApi["get"] = async (
+  credential,
+  format,
+  context
+) => {
+  const { uri, idx } = await getStatusListEntry(credential, format);
+  const statusList = await getStatusListByUri(uri, context);
+  return { uri, idx, statusList, format: "jwt" };
 };

package/src/credential/status/v1.3.3/02-verify-and-parse-status-list.ts

@@ -1,33 +1,11 @@
-import { verify } from "@pagopa/io-react-native-jwt";
-import { getListFromStatusListJWT } from "@sd-jwt/jwt-status-list";
+import { decode as decodeJwt, verify } from "@pagopa/io-react-native-jwt";
 import type { StatusListApi } from "../api/status-list";
-
-/**
- * Mapping of status bits to their corresponding meaning as defined in the specification.
- * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/credential-revocation.html#token-status-lists
- */
-const CredentialStatusMap = {
-  0x00: "VALID",
-  0x01: "INVALID",
-  0x02: "SUSPENDED",
-  0x03: "UPDATE",
-  0x0b: "ATTRIBUTE_UPDATE",
-} as const;
-
-type CredentialStatusBit = keyof typeof CredentialStatusMap;
+import { StatusList } from "../api/types";
 
 export const verifyAndParseStatusList: StatusListApi["verifyAndParse"] = async (
   keys,
-  { statusList: rawStatusList, idx }
+  statusList
 ) => {
-  await verify(rawStatusList, keys);
-
-  const statusList = getListFromStatusListJWT(rawStatusList);
-  const statusBit = statusList.getStatus(idx) as CredentialStatusBit;
-  const status = CredentialStatusMap[statusBit];
-
-  return {
-    status,
-    statusBit: `0x${statusBit.toString(16).padStart(2, "0").toUpperCase()}`,
-  };
+  await verify(statusList, keys);
+  return StatusList.parse(decodeJwt(statusList).payload);
 };

package/src/credential/status/v1.3.3/03-get-status.ts

@@ -0,0 +1,40 @@
+import { StatusList as JwtStatusList } from "@sd-jwt/jwt-status-list";
+import { IoWalletError } from "../../../utils/errors";
+import type { StatusListApi } from "../api/status-list";
+
+/**
+ * Mapping of status bits to their corresponding meaning as defined in the specification.
+ * @see https://italia.github.io/eid-wallet-it-docs/releases/1.3.3/en/credential-revocation.html#token-status-lists
+ */
+const CredentialStatusMap = {
+  0x00: "VALID",
+  0x01: "INVALID",
+  0x02: "SUSPENDED",
+  0x03: "UPDATE",
+  0x0b: "ATTRIBUTE_UPDATE",
+} as const;
+
+type CredentialStatusBit = keyof typeof CredentialStatusMap;
+
+const formatStatusBit = (statusBit: number) =>
+  `0x${statusBit.toString(16).padStart(2, "0").toUpperCase()}`;
+
+export const getStatus: StatusListApi["getStatus"] = (statusList, idx) => {
+  const decodedStatusList = JwtStatusList.decompressStatusList(
+    statusList.lst,
+    statusList.bits
+  );
+  const statusBit = decodedStatusList.getStatus(idx) as CredentialStatusBit;
+  const status = CredentialStatusMap[statusBit];
+
+  if (!status) {
+    throw new IoWalletError(
+      `Unsupported credential status bit: ${formatStatusBit(statusBit)}`
+    );
+  }
+
+  return {
+    status,
+    rawStatus: formatStatusBit(statusBit),
+  };
+};

package/src/credential/status/v1.3.3/index.ts

@@ -1,6 +1,7 @@
 import type { CredentialStatusApi } from "../api";
-import { getStatusList } from "./01-status-list";
+import { getStatusList, getStatusListByUri } from "./01-status-list";
 import { verifyAndParseStatusList } from "./02-verify-and-parse-status-list";
+import { getStatus } from "./03-get-status";
 
 export const CredentialStatus: CredentialStatusApi = {
   statusAssertion: {
@@ -9,6 +10,8 @@ export const CredentialStatus: CredentialStatusApi = {
   statusList: {
     isSupported: true,
     get: getStatusList,
+    getByUri: getStatusListByUri,
     verifyAndParse: verifyAndParseStatusList,
+    getStatus,
   },
 };

package/src/credentials-catalogue/api/index.ts

@@ -54,7 +54,7 @@ export interface CredentialsCatalogueApi {
    * Given a statusBit (e.g. "0x00", "0x0B") and a DigitalCredential from the
    * catalogue, returns the matching l10n IDs or undefined if not found.
    * The comparison is case-insensitive to handle uppercase statusBit values
-   * returned by verifyAndParseStatusList against lowercase keys in the catalogue.
+   * returned by getStatus against lowercase keys in the catalogue.
    *
    * @since 1.0.0
    */

package/src/credentials-catalogue/common/get-status-l10n-ids.ts

@@ -5,7 +5,7 @@ import { type CredentialsCatalogueApi } from "../api";
  * Given a statusBit (e.g. "0x00", "0x0B") and a DigitalCredential from the
  * catalogue, returns the matching l10n IDs or undefined if not found.
  * The comparison is case-insensitive to handle uppercase statusBit values
- * returned by verifyAndParseStatusList against lowercase keys in the catalogue.
+ * returned by getStatus against lowercase keys in the catalogue.
  */
 export const getStatusL10nIds: CredentialsCatalogueApi["getStatusL10nIds"] = (
   statusBit,